Netgear WNR2000 v3

2016-01-22 19:00 +0100 by Micu (0 comments)

I have bought an used Netgear WNR2000 v3 in order to test and install OpenWrt software on it. In process I did some improvements to software as well as got better knowledge about WNR2000v3 "family". Although they are not new, they are still easily obtainable and can serve very well in home or small office network. Here are some data about this device.

Netgear WNR2000 v3

It is a single band 2.4 GHz draft 802.11n (N300) wireless router. Launched September 2010, reached EOL (End of Life).
See manufacturer's page for product manuals, original firmware etc.

WikiDevi information page is here.

OpenWrt page for Netgear WNR2000 product family is here.

For full LED and button functionality you need either latest trunk or Chaos Chalmer 15.05.1 with these patches applied.

Please be aware that this device comes in more than one hardware revision.
This page is for router version 3 only !

Hardware summary

CPUAtheros AR7241360 MHz, MIPS-compatible, 32-bit, SoC
Flash4 MBNOR, SPI, SOP-8, Macronix MX25L3206EM2I *
RAM32 MBESMT M13S2561616A
Ethernet4 x 100 Mbps 
WAN1 x 100 Mbps 
WLANAtheros AR9287 
SerialYes4-pin 3.3V
PowerDC 12V 1A 

* Also confirmed to work with following 4M flash memory chips: Winbond W25X32VSIG, Winbond W25Q32FVSIG




Color 0greengreenbluegreengreengreengreengreen
Color 1amberamber amberamberamberamber 


Serial port works at 3.3V.
USB TTL converter is required when connecting to USB serial port in computer.

Serial port

Serial pins are located on the right side of metal casing (having Ethernet ports on top and LEDs on bottom). Connector is marked as JP1 and pin 1 is on bottom (marked with dot). For connection to be successful, 3 pins have to be wired to serial converter (Tx, Rx and GND - do not use Vcc).


How to open case

There are 2 types of case: with 1 and with 2 torcx screws at the bottom. Version with 2 screws allows access to top of circuit board where serial port is located. The other case requires to take out board from case completely.

U-Boot bootloader

This software runs at router power up and is responsible for basic device initialization and loading the main operating system (firmware). It provides emergency recovery mode to load firmware from network if system gets corrupted.

This is in fact very robust environment - using serial console connection and command line interface we can flash OS images and even U-Boot itself! U-Boot provides range of tools for memory access and copying (both flash and RAM), network tools (ping and tftp) and more.

U-Boot occupies first 256kB of flash memory (addresses 0x00000000 - 0x0003FFFF) and is followed by 64kB environment data (0x00040000 - 0x0004FFFF) which contains system variables. Do not confuse these addresses with CPU memory locations. Processor maps flash memory area to addresses 0x9F000000 - 0x9F3FFFFF.

Flash offsetCPU addressSizeLabelFunction
0x000000000x9F000000256 kBu-bootU-Boot binary
0x000400000x9F04000064 kBu-boot-envU-Boot environment
0x000500000x9F0500003712 kBfirmwareOperating system
0x003F00000x9F3F000064 kBartAtheros Radio Test partition

Once started, bootloader copies itself from flash (0x9F000000) to RAM memory (near top of 32MB, at 0x81FB8000) and runs from there (that's why it is possible to flash U-Boot from U-Boot).

ART partition located at the end of flash memory contains vital information regarding router board configuration.

ART offsetSize in bytesDescription
0x00006WAN MAC address
0x00066LAN MAC address
0x000C8WPS PIN
0x001413Device serial number
0x00212Region number
0x002314Board hardware ID ("29763551+04+32") *
0x003110Board model ID ("wnr2000v3")
0x100061440Wireless device calibration data **

* (8 MSB of PCB number) + (Flash size) + (SDRAM size)
** required for correct setup of AR9287 radio ; protected by checksum

That is all for now. Please return for more information about WNR2000v3 and its derivatives as well as Uboot and OpenWrt in general.